2026-08-04_6b7a5a78be8b207aa4ce958846320efe_cobalt-strike_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_6b7a5a78be8b207aa4ce958846320efe_cobalt-strike_glassworm_icedid_njrat_vidar
Size 5.3MB
Sample260804-2sp71afl5y
SHA256 6bfa8b9097b9265662f95470573ab88be83aaddfde9fdc027c952ddd4d78a1ea
MD5 6b7a5a78be8b207aa4ce958846320efe
SHA1 136ba7cdf239b907cbbdb9af2a3d19aedddb49ca
SHA512 79e73887ecea0b352e6180c47d2a78d1019f8740ea7ed1059b86a2b9ea6b399af60a92b1906f6930349b46efe16773c38622e51b1d43896f5d2d5e75a5f4e940
SSDEEP 49152:xN+zKli0YRjpI5e1hMQVPL9dBpF0q/POariWYzvn/a63mhBNAP5MKppx22dphCbW:x6Sg1/qSgsY5MoueRP7XvYCp3nyG
TLSH
T1F546270633F81388F1F7967C96B65616CA76BC198B21C7CF0160915E1E33AE58D7AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_6b7a5a78be8b207aa4ce958846320efe_cobalt-strike_glassworm_icedid_njrat_vidar

File Explorer

2026-08-04_6b7a5a78be8b207aa4ce958846320efe_cobalt-strike_glassworm_icedid_njrat_vidar

.exe 5.3MB

2026-08-04_6b7a5a78be8b207aa4ce958846320efe_cobalt-strike_glassworm_icedid_njrat_vidar

IMPHASH 4d97d0e7157161f3b7d8a1765dd13a5e
SHA256 6bfa8b9097b9265662f95470573ab88be83aaddfde9fdc027c952ddd4d78a1ea
MD5 6b7a5a78be8b207aa4ce958846320efe
SHA1 136ba7cdf239b907cbbdb9af2a3d19aedddb49ca
SHA512 79e73887ecea0b352e6180c47d2a78d1019f8740ea7ed1059b86a2b9ea6b399af60a92b1906f6930349b46efe16773c38622e51b1d43896f5d2d5e75a5f4e940
SSDEEP 49152:xN+zKli0YRjpI5e1hMQVPL9dBpF0q/POariWYzvn/a63mhBNAP5MKppx22dphCbW:x6Sg1/qSgsY5MoueRP7XvYCp3nyG
TLSH
T1F546270633F81388F1F7967C96B65616CA76BC198B21C7CF0160915E1E33AE58D7AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\76724\LVInstaller\VideofusionInstaller\src\JIanyingInstaller\x64\CC_RELEASE\JianyingLauncher.pdb

dbghelp

SymCleanup SymFunctionTableAccess64 SymGetModuleBase64 SymSetOptions SymInitialize SymGetSearchPathW SymSetSearchPathW SymFromAddr SymGetLineFromAddr64 StackWalk64

propsys

InitPropVariantFromCLSID

ws2_32

ioctlsocket

setupapi

CM_Get_Device_IDW SetupDiEnumDeviceInfo SetupDiGetClassDevsW

winmm

timeEndPeriod timeGetTime timeBeginPeriod

kernel32

WaitForSingleObject OpenProcess GetWindowsDirectoryW FreeLibrary LoadLibraryW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcess GetCurrentThread GetCurrentDirectoryW LocalFileTimeToFileTime SetFilePointer SetFileTime SystemTimeToFileTime DecodePointer InitializeCriticalSectionEx DeleteCriticalSection GetFileInformationByHandle GetLocalTime GetTickCount CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime ProcessIdToSessionId GetCommandLineW GetEnvironmentVariableW CreateFileA GetDiskFreeSpaceExW GetVolumeInformationW QueryDosDeviceW GetTempPathW GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetVersion GetSystemDirectoryW LocalAlloc lstrcmpW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW CopyFileW MoveFileExW WTSGetActiveConsoleSessionId InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent CreateEventW CreateThread MoveFileW SetEnvironmentVariableW InitializeCriticalSectionAndSpinCount Sleep OpenMutexA GetCurrentThreadId K32EnumProcessModules SetCurrentDirectoryW GetFileAttributesExW GetFinalPathNameByHandleW GetLogicalDriveStringsW GetVolumePathNameW DuplicateHandle GetModuleHandleA ReplaceFileW CreateHardLinkW FindFirstFileExW GetProcessId OutputDebugStringA FormatMessageA LoadLibraryExW GetModuleHandleExW GetNativeSystemInfo GetProductInfo IsWow64Process ReleaseSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency SetThreadPriority GetThreadPriority GetSystemTimeAsFileTime GetProcAddress SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime GetVersionExW GetFileSizeEx LockFileEx SetEndOfFile SetFileInformationByHandle SetFilePointerEx UnlockFileEx UnregisterWaitEx RegisterWaitForSingleObject IsDebuggerPresent GetThreadId GetUserDefaultLangID AcquireSRWLockExclusive lstrcmpiA GlobalMemoryStatusEx WaitForMultipleObjects TlsGetValue VirtualAlloc VirtualFree FlushViewOfFile VirtualQuery GetProcessTimes SetPriorityClass GetPriorityClass HeapSetInformation GetSystemInfo GetProcessIoCounters K32GetPerformanceInfo CreateThreadpool SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum CloseThreadpool CallbackMayRunLong CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork TlsSetValue TlsAlloc TlsFree RtlCaptureStackBackTrace SetUnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetInformationJobObject GetModuleHandleExA InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared InitOnceExecuteOnce RtlVirtualUnwind VirtualProtect LoadLibraryExA OutputDebugStringW WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetTickCount64 GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW SleepConditionVariableCS FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer TryEnterCriticalSection InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx LocalFree QueryThreadCycleTime GetStringTypeW CompareStringEx GetCPInfo RtlPcToFileHeader RtlUnwindEx GetModuleHandleW SetLastError DeviceIoControl GetDateFormatW SetFileAttributesW GetLongPathNameW GetFullPathNameW ExpandEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar CloseHandle WriteFile ReadFile GetFileSize CreateFileW FindResourceW SizeofResource LockResource LoadResource GetModuleFileNameW FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException RemoveDirectoryW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateDirectoryW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait IsValidLocale GetUserDefaultLCID GetFileInformationByHandleEx CreateSymbolicLinkW EnumSystemLocalesW ReadConsoleW GetDriveTypeW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers WriteConsoleW GetStdHandle ExitProcess GetConsoleMode GetConsoleOutputCP GetFileType SetStdHandle SetConsoleCtrlHandler InterlockedFlushSList InterlockedPushEntrySList RtlUnwind GetLocaleInfoEx

user32

SetTimer GetQueueStatus PostQuitMessage MsgWaitForMultipleObjectsEx PeekMessageW DefWindowProcW TranslateMessage CharUpperW SetProcessDPIAware RemovePropW SetPropW GetSystemMetrics GetUserObjectInformationW GetThreadDesktop GetWindowThreadProcessId GetClassNameW EnumWindows GetWindowLongW GetWindowTextLengthW GetWindowTextW PostMessageW ExitWindowsEx UnregisterClassW GetDesktopWindow GetDC RegisterClassExW CreateWindowExW DestroyWindow GetWindowLongPtrW SetWindowLongPtrW FindWindowExW KillTimer DispatchMessageW

advapi32

GetSidSubAuthorityCount SystemFunction036 RegNotifyChangeKeyValue RegEnumValueW RegDeleteValueW ConvertSidToStringSidW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegEnumKeyExW RegDeleteKeyExW RegCreateKeyExW RegOpenCurrentUser RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl MapGenericMask IsValidSecurityDescriptor InitializeSecurityDescriptor ImpersonateLoggedOnUser GetFileSecurityW FreeSid EqualSid DuplicateToken AllocateAndInitializeSid AddAccessAllowedAce AccessCheck LookupPrivilegeValueW RevertToSelf ImpersonateSelf AdjustTokenPrivileges OpenThreadToken SetThreadToken ConvertStringSidToSidW LookupAccountSidW SetTokenInformation GetTokenInformation DuplicateTokenEx OpenProcessToken CreateProcessAsUserW SetNamedSecurityInfoW GetNamedSecurityInfoW IsValidSid InitializeSid InitializeAcl GetSidSubAuthority GetSidLengthRequired GetLengthSid GetAclInformation GetAce CopySid AddAce

ole32

CoInitialize CoRevokeInitializeSpy CoRegisterInitializeSpy CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoUninitialize CoInitializeEx PropVariantClear

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathW SHGetFolderPathA SHGetSpecialFolderPathW

oleaut32

VariantClear SysStringLen SysAllocString SysFreeString

shlwapi

StrToIntW ord437 PathMatchSpecW ord176 SHSetValueW StrChrW StrCmpNW StrCmpNIW StrRChrW StrCmpIW StrCpyNW SHGetValueW PathAppendW PathRemoveFileSpecW PathIsDirectoryW PathGetDriveNumberW PathFindExtensionW PathAddBackslashW PathFileExistsW

gdi32

DeleteObject GetDeviceCaps

userenv

CreateEnvironmentBlock UnloadUserProfile LoadUserProfileW DestroyEnvironmentBlock

mpr

WNetGetResourceInformationW

psapi

EnumProcessModules GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

iphlpapi

GetAdaptersAddresses

??0MemoryAllocatorDumpGuid@trace_event@base@@QEAA@_K@Z ??0ReadOnlySharedMemoryRegion@base@@AEAA@VPlatformSharedMemoryRegion@subtle@1@@Z ??0ReadOnlySharedMemoryRegion@base@@QEAA@$$QEAV01@@Z ??0ReadOnlySharedMemoryRegion@base@@QEAA@XZ ??0UnsafeSharedMemoryRegion@base@@AEAA@VPlatformSharedMemoryRegion@subtle@1@@Z ??0UnsafeSharedMemoryRegion@base@@QEAA@$$QEAV01@@Z ??0UnsafeSharedMemoryRegion@base@@QEAA@XZ ??0WritableSharedMemoryRegion@base@@AEAA@VPlatformSharedMemoryRegion@subtle@1@@Z ??0WritableSharedMemoryRegion@base@@QEAA@$$QEAV01@@Z ??0WritableSharedMemoryRegion@base@@QEAA@XZ ??1ReadOnlySharedMemoryRegion@base@@QEAA@XZ ??1UnsafeSharedMemoryRegion@base@@QEAA@XZ ??1WritableSharedMemoryRegion@base@@QEAA@XZ ??4MemoryAllocatorDumpGuid@trace_event@base@@QEAAAEAV012@$$QEAV012@@Z ??4MemoryAllocatorDumpGuid@trace_event@base@@QEAAAEAV012@AEBV012@@Z ??4ReadOnlySharedMemoryRegion@base@@QEAAAEAV01@$$QEAV01@@Z ??4UnsafeSharedMemoryRegion@base@@QEAAAEAV01@$$QEAV01@@Z ??4WritableSharedMemoryRegion@base@@QEAAAEAV01@$$QEAV01@@Z ??8MemoryAllocatorDumpGuid@trace_event@base@@QEBA_NAEBV012@@Z ??9MemoryAllocatorDumpGuid@trace_event@base@@QEBA_NAEBV012@@Z ??MMemoryAllocatorDumpGuid@trace_event@base@@QEBA_NAEBV012@@Z ?ConvertToReadOnly@WritableSharedMemoryRegion@base@@SA?AVReadOnlySharedMemoryRegion@2@V12@@Z ?ConvertToUnsafe@WritableSharedMemoryRegion@base@@SA?AVUnsafeSharedMemoryRegion@2@V12@@Z ?Create@ReadOnlySharedMemoryRegion@base@@SA?AUMappedReadOnlyRegion@2@_K@Z ?Create@UnsafeSharedMemoryRegion@base@@SA?AV12@_K@Z ?Create@WritableSharedMemoryRegion@base@@SA?AV12@_K@Z ?Deserialize@ReadOnlySharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?Deserialize@UnsafeSharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?Deserialize@WritableSharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?Duplicate@ReadOnlySharedMemoryRegion@base@@QEBA?AV12@XZ ?Duplicate@UnsafeSharedMemoryRegion@base@@QEBA?AV12@XZ ?GetGUID@ReadOnlySharedMemoryRegion@base@@QEBAAEBVUnguessableToken@2@XZ ?GetGUID@UnsafeSharedMemoryRegion@base@@QEBAAEBVUnguessableToken@2@XZ ?GetGUID@WritableSharedMemoryRegion@base@@QEBAAEBVUnguessableToken@2@XZ ?GetPlatformHandle@ReadOnlySharedMemoryRegion@base@@QEBAPEAXXZ ?GetPlatformHandle@UnsafeSharedMemoryRegion@base@@QEBAPEAXXZ ?GetSize@ReadOnlySharedMemoryRegion@base@@QEBA_KXZ ?GetSize@UnsafeSharedMemoryRegion@base@@QEBA_KXZ ?GetSize@WritableSharedMemoryRegion@base@@QEBA_KXZ ?IsValid@ReadOnlySharedMemoryRegion@base@@QEBA_NXZ ?IsValid@UnsafeSharedMemoryRegion@base@@QEBA_NXZ ?IsValid@WritableSharedMemoryRegion@base@@QEBA_NXZ ?Map@ReadOnlySharedMemoryRegion@base@@QEBA?AVReadOnlySharedMemoryMapping@2@XZ ?Map@UnsafeSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@XZ ?Map@WritableSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@XZ ?MapAt@ReadOnlySharedMemoryRegion@base@@QEBA?AVReadOnlySharedMemoryMapping@2@J_K@Z ?MapAt@UnsafeSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@J_K@Z ?MapAt@WritableSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@J_K@Z ?TakeHandleForSerialization@ReadOnlySharedMemoryRegion@base@@SA?AVPlatformSharedMemoryRegion@subtle@2@V12@@Z ?TakeHandleForSerialization@UnsafeSharedMemoryRegion@base@@SA?AVPlatformSharedMemoryRegion@subtle@2@V12@@Z ?TakeHandleForSerialization@WritableSharedMemoryRegion@base@@SA?AVPlatformSharedMemoryRegion@subtle@2@V12@@Z ?ThrowBadVariantAccess@variant_internal@absl@@YAXXZ ?ToUint64@MemoryAllocatorDumpGuid@trace_event@base@@QEBA_KXZ ?UnsafeGetPlatformHandle@WritableSharedMemoryRegion@base@@QEBAPEAXXZ ?create_hook_@ReadOnlySharedMemoryRegion@base@@0P6A?AUMappedReadOnlyRegion@2@_K@ZEA ?create_hook_@UnsafeSharedMemoryRegion@base@@0P6A?AV12@_K@ZEA ?create_hook_@WritableSharedMemoryRegion@base@@0P6A?AV12@_K@ZEA ?empty@MemoryAllocatorDumpGuid@trace_event@base@@QEBA_NXZ ?g_swallow_stream@logging@@3PEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@EA ?kDisableBestEffortTasks@switches@@3QBDB ?kDisableBreakpad@switches@@3QBDB ?kDisableFeatures@switches@@3QBDB ?kDisableHighResTimer@switches@@3QBDB ?kDisableLowEndDeviceMode@switches@@3QBDB ?kDisableUsbKeyboardDetect@switches@@3QBDB ?kEnableBackgroundThreadPool@switches@@3QBDB ?kEnableCrashReporter@switches@@3QBDB ?kEnableFeatures@switches@@3QBDB ?kEnableLowEndDeviceMode@switches@@3QBDB ?kForceFieldTrials@switches@@3QBDB ?kFullMemoryCrashReport@switches@@3QBDB ?kLogBestEffortTasks@switches@@3QBDB ?kNoErrorDialogs@switches@@3QBDB ?kProfilingAtStart@switches@@3QBDB ?kProfilingFile@switches@@3QBDB ?kProfilingFlush@switches@@3QBDB ?kTestChildProcess@switches@@3QBDB ?kTestDoNotInitializeIcu@switches@@3QBDB ?kTraceToFile@switches@@3QBDB ?kTraceToFileName@switches@@3QBDB ?kV@switches@@3QBDB ?kVModule@switches@@3QBDB ?kWaitForDebugger@switches@@3QBDB ?set_create_hook@ReadOnlySharedMemoryRegion@base@@CAXP6A?AUMappedReadOnlyRegion@2@_K@Z@Z ?set_create_hook@UnsafeSharedMemoryRegion@base@@CAXP6A?AV12@_K@Z@Z ?set_create_hook@WritableSharedMemoryRegion@base@@CAXP6A?AV12@_K@Z@Z ?throw_bad_optional_access@optional_internal@absl@@YAXXZ GetHandleVerifier

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

68KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

minATL

Size

1024B

Virtual Size

809B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_6b7a5a78be8b207aa4ce958846320efe_cobalt-strike_glassworm_icedid_njrat_vidar

dbghelp

propsys

ws2_32

setupapi

winmm

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

userenv

mpr

psapi

iphlpapi

generic